Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc29e449a32b4540…

MALICIOUS

PDF

35.7 KB Created: 2020-04-02 04:00:13 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 61fce7f7464822e8a60f66cfbb1adaa5 SHA-1: 07e25ecf2f9b2d88b4ca97884954ab93a3e47a97 SHA-256: bc29e449a32b4540b4836a5bc1c8569f1da47c0d6105c2cc9b9e16fd90289ad8
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are numerically or generically named and hosted on unrelated domains, indicating a link farm or SEO spam tactic. The document body text, though partially corrupted, suggests a lure related to a '1997 polaris magnum 425 4x4 service manual'. The primary heuristic identified a mass external PDF link farm, with the first URL pointing to a potentially malicious PDF. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myentouragemusic.com/uploads/1/3/0/8/130874646/130874646.html#1997+polaris+magnum+425+4x4+service+manual
    • http://steercrazyquarterhorses.com/uploads/1/3/1/1/131163737/vujuvefupilom.pdf
    • http://elitefiberglassrepair.com/uploads/1/3/0/3/130313427/musepamozikulex.pdf
    • http://mojonz.co.nz/uploads/1/3/0/9/130969811/lebonajifur-kubej.pdf
    • http://shopaff.com/uploads/1/3/0/3/130313388/xepale_sabikopusilafej.pdf
    • http://taylorraebeauty.com/uploads/1/3/0/5/130540874/zidigivuzitoraduzofa.pdf
    • http://cindishaffer.com/uploads/1/3/0/5/130590496/1541701.pdf
    • http://orabell.net/uploads/1/3/0/7/130775154/5e1dff09807c.pdf
    • http://creativeresurrection.com/uploads/1/3/0/9/130969501/3794851.pdf
    • http://coralscreations.net/uploads/1/3/1/3/131379118/3971789.pdf
    • http://tahoeplans.com/uploads/1/3/0/7/130776123/pekakademapobuf.pdf
    • http://primitivedesignsandmore.com/uploads/1/3/0/4/130490250/wenudavonu.pdf
    • http://livingoutofthisworld.com/uploads/1/3/0/4/130483767/jewusa.pdf
    • http://soulwarrior.us/uploads/1/3/0/5/130539645/xamopu.pdf
    • http://pittransformation.com/uploads/1/3/1/3/131383949/9552e14a75af1e.pdf
    • http://surfinghomeschoolers.net/uploads/1/3/0/9/130968956/3948146.pdf
    • http://impact-active.com/uploads/1/3/0/5/130550787/watesifakunilu_beremujakufeju_difobol.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064c5.bin
70d0f3f78683f6b5601ae6e385cf4b03c67d5f70ab2117851a8fbfd32f0e35c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64C5 6788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.